CN105187205A - Certificateless authentication key negotiation method and system based on hierarchical identities - Google Patents

Abstract

The invention discloses a certificateless authentication key negotiation method and system based on hierarchical identities. The method comprises the following steps: solving an elliptical curve circulation additive group according to input safety constants, and calculating a public key of the system by selecting a main private key and two safety hash functions; calculating a part of private keys and a part of public keys of a first user according to the main private key, the identity of the first user and a set of selected random numbers; calculating the private key of the first user according to a part of private keys of the first user and one selected random number; calculating a part of private keys and a part of public keys of the first user according to the upper-layer user identity of the first user, a part of private keys and a part of public keys of the upper-layer user and one random number; and calculating a session key according to temporary information, the private keys and the public keys selected by a second user and a third user. The method disclosed by the invention is applied to large-scale systems and has high efficiency; the key escrow problem is avoided; and the safety key negotiation requirements are satisfied.

Description

Without the authentication key agreement method based on level identity base and the negotiating system of certificate

Technical field

The present invention relates to the cryptographic system without certificate, be specifically related to a kind of authentication key agreement method based on level identity base without certificate and negotiating system.

Background technology

Public-key cryptosystem is the important technology ensureing security of network and information.At traditional PKIX (PKI, PublicKeyInfrastructure) in, need trusted third party to be that user issues certificate to prove the legal identity of user, therefore relate to the problem of a lot of certificate management, occupy a large amount of system related resource.In order to simplify the management process of conventional public-key infrastructure to certificate, Shamir proposed a kind of identity base cryptographic system (IBC, IdentityBasedCryptosystem) in 1984.This system does not use certificate, directly using the identity of user as PKI, private key is generated by believable private key generating center PKG (PublicKeyGenerator).

But in the IBC system of Shamir proposition, the private key of user is generated by PKG completely, if PKG is under attack cause information leakage, then assailant can obtain the long-term private of user, carrys out fake user with this.The key escrow that IBC system that Here it is is intrinsic.In order to address this problem, Al-Riyami and Paterson proposed identity base cryptographic system (CLIBC, CertificatelessIdentityBasedCryptosystem) without certificate in 2003.In this system, PKG is only user's generating portion private key, and the part private key that complete private key is generated in conjunction with PKG by user and self selected privately owned secret value generate jointly.Therefore, certificateless cryptosystem had both solved the certificate management problem in conventional public-key cryptographic system, solved again the key escrow in identity base cryptographic system.

All only containing a PKG in IBE and CLIBE system.PKG not only carries identifying user identity and generates the task of private key for user, also will bear maintenance safe channel so that the task of sending to user of private key safety, and PKG also will be responsible for the renewal of private key for user simultaneously, the work such as to cancel.Obviously, single PKG can not bear large scale system hard work.In order to address this problem, cryptologist Gentry and Silverberg and 2002 year first time proposed level identity base cryptographic system (HIBC, HierarchicalIdentityBasedCryptography).Comprise the territory PKG of a root PKG and multilayer in this system, root PKG authentication domain PKG also generates private key for it, and territory, upper strata PKG verifies lower floor territory PKG and generates private key, until the last layer territory of user for it.But in HIBC system, still there is key escrow.2008, Chow, Roth and Rieffel were then studied the layering cryptographic system (HCLC, HierarchicalCertificatelessCryptography) without certificate first.This system had both remained the advantage of HIBC system, turn avoid the key escrow in HIBC system.

Key agreement, as the foundation in cryptography, has vital effect in secure communication.It allows two entities on open channel, to consult safe session key, to ensure the safety of intercommunication.Based on the identity base cryptographic system without certificate, scholars propose a large amount of identity base subjective entropy without certificate.But, most ofly all to propose under single PKG environment without certificate identity base subjective entropy.Meanwhile, the Bilinear map computing on elliptic curve is consuming time is approximately 20 times of point multiplication operation, and therefore efficiency is lower.For this problem, have scholar to propose the identity base key agreement protocol without certificate without Bilinear map computing, but this quasi-protocol also all propose under single PKG environment.

Elliptic curve cipher (ECC, Ellipticcurvecryptography) is compared with other public-key cryptosystems, and its main advantage is that system parameters is shorter under identical lsafety level, therefore uses the most extensive in identity base cryptographic system.In the key agreement protocol without Bilinear map computing, the fail safe one of agreement is based on Elliptic Curve Discrete Logarithm difficulty hypothesis, namely for the q rank circled addition group on elliptic curve, given two elements wherein it is difficult for calculating a by P, aP, but is easy by P, a calculating aP.Two is based on computational Diffie-Hellman difficulty hypothesis, namely for the q rank circled addition group on elliptic curve, given three elements wherein it is difficult for calculating abP.

Summary of the invention

The present invention is intended at least one of solve the problems of the technologies described above.

For this reason, first object of the present invention is to propose a kind of authentication key agreement method based on level identity base without certificate.

Second object of the present invention is to propose a kind of authenticated key agreement system based on level identity base without certificate.

To achieve these goals, embodiment of the present invention discloses a kind of authentication key agreement method based on level identity base without certificate, comprises the following steps: A: according to the safe constant λ of input, show that exponent number is the elliptic curve circled addition group of q , its generator is P, chooses main private key msk, calculates PKI P _pub, choose safe hash function H ₁with hash function H ₂; B: according to the identity vector ID=(I of first user ₁, I ₂..., I _t), the private key d:B1 of described first user can be generated by two kinds of algorithms: according to described main private key msk, described first user identity vector ID=(I ₁, I ₂..., I _t) and random selecting root PKG calculates part private key k and the part PKI g of described first user ₁p ..., g _tp, described first user verifies whether described part private key k meets verification condition, if described part private key k meets verification condition, described first user accepts described part private key k and part PKI g ₁p ..., g _tp; B2: according to described part private key k and part PKI g ₁p ..., g _tp and random selecting generate private key d and the PKI pk of described first user; Or B ' 1: according to the identity vector ID=(I of described first user ₁, I ₂..., I _t), the identity vector ID of the upper-layer user of described first user _pKG=(I ₁, I ₂..., I _t-1), the part private key k ' of described upper-layer user, part PKI { g ₁p ..., g _t-1p} and random selecting the PKG of described upper-layer user is described first user generating portion private key k and part PKI g ₁p ..., g _tp, described first user verifies whether described part private key k meets verification condition, if described part private key k meets verification condition, described first user accepts described part private key k and part PKI g ₁p ..., g _tp; B ' 2: according to described part private key k and part PKI g ₁p ..., g _tp and random selecting generate private key d and the PKI pk of described first user.

According to the authentication key agreement method based on level identity base without certificate of the embodiment of the present invention, based on the level identity base cryptographic system without certificate, be applicable to large scale system, and method does not contain Bilinear map computing in calculating process, therefore has higher efficiency.The fail safe of method, based on Elliptic Curve Discrete Logarithm difficulty hypothesis and computational Diffie-Hellman difficulty hypothesis, meets the basic security demand needed for key agreement system.

In addition, the authentication key agreement method based on level identity base without certificate according to the above embodiment of the present invention, can also have following additional technical characteristic:

Further, described steps A comprises further: described elliptic curve circled addition group for the elliptic curve circled addition group that the rank meeting safe constant λ are q; Described PKI P _pub=sP, wherein main private key msk=s; Described hash function and described hash function wherein for session key space.

Further, described step B1 comprises further: according to described main private key msk, described first user identity vector ID=(I ₁, I ₂..., I _t) and described PKG random selecting calculate r _i=H ₁(I _i|| g _ip), wherein 1≤i≤t, the part private key k of described first user is:

$k=s+\underset{i=1}{\overset{t}{\Σ}}\left(g_i{r}_i\right)$

If k=0, then need again to choose by safe lane by { g ₁p ..., g _tp, k} send to described first user, wherein g ₁p ..., g _tp is the part PKI of described first user, described first user checking following equalities:

$kP=P_{pub}+\underset{i=1}{\overset{t}{\Σ}}\left(H_1\right(I_i\left|\right|g_{i}P\left)g_{i}P\right)$

If equation is false, then refuse described part private key k and part PKI g ₁p ..., g _tp.

Further, described step B2 comprises further: random selecting generate described first user private key d,

d＝k+x

If d=0, again choose calculate the private key d of described first user, the PKI of described first user is pk={ID, g ₁p ..., g _tp, xP}.

Further, described step B ' 1 comprises further: according to the identity vector ID=(I of described first user ₁, I ₂..., I _t), described first user upper-layer user ID _pKG=(I ₁, I ₂..., I _t-1), the part private key of described upper-layer user part PKI { the g of described upper-layer user ₁p ..., g _t-1p} and random selecting calculate r _t=H ₁(I _t|| g _tp), the PKG of described upper-layer user is that described first user generates described part private key k, and described part private key k is obtained by following formula:

$k=k^{\′}+g_t{r}_t=s+{\mathrm{\Σ}}_{i=1}^{t-1}\left(g_i{r}_i\right)+g_t{r}_t=s+{\mathrm{\Σ}}_{i=1}^t\left(g_i{r}_i\right),$

If k=0, then need again to choose calculate described part private key k, by safe lane by { g ₁p ..., g _tp, k} send to described first user, wherein g ₁p ..., g _tp is the part PKI of described first user, described first user checking following equalities:

$kP=P_{pub}+\underset{i=1}{\overset{t}{\Σ}}\left(H_1\right(I_i\left|\right|g_{i}P\left)g_{i}P\right)$

If equation is false, described first user refuses described part private key k and part PKI g ₁p ..., g _tp.

Further, described step B ' 2 comprises further: random selecting generate described first user private key d,

d＝k+x

If d=0, again choose calculate the private key d of described first user, the PKI of described first user is pk={ID, g ₁p ..., g _tp, xP}.

Further, further comprising the steps of in step B:

C: Stochastic choice second user A and the 3rd user B, according to the identity vector of described second user A second private key for user d _a, the second client public key pk _awith the identity vector of described 3rd user B 3rd private key for user d _b, the 3rd client public key pk _b, and the second user and the 3rd user's random selecting with calculate described second user A sends out the first session key sk from message use to described 3rd user B _awith described 3rd user B to described second user A send out message use the second session key sk _bif, described first session key sk _awith described second session key sk _bidentical, can securely communicate between described second user A and described 3rd user B.

To achieve these goals, embodiment of the present invention discloses a kind of authenticated key agreement system based on level identity base without certificate, comprising: system sets up module, for the safe constant λ according to input, show that exponent number is q elliptic curve circled addition group its generator is P, chooses main private key msk, calculates PKI P _pub, choose safe hash function H ₁with hash function H ₂; Private key generation module, described private key generation module is used for according to described main private key msk, described first user identity vector ID=(I ₁, I ₂..., I _t) and random selecting calculate part private key k and the part PKI g of described first user ₁p ..., g _tp, after verifying by authentication module, and according to described part private key k and part PKI g ₁p ..., g _tp and random selecting generate private key d and the PKI pk of described first user, wherein, the set of expression integer 1,2 ..., q-2, q-1}; Private key commit module, described private key commit module is used for the identity vector ID=(I according to described first user ₁, I ₂..., I _t), the upper-layer user ID of described first user _pKG=(I ₁, I ₂..., I _t-1), the part private key k ' of described upper-layer user, part PKI { g ₁p ..., g _t-1p} and random selecting generate part private key k and the part PKI g of described first user ₁p ..., g _tp, after described authentication module checking, and according to described part private key k and part PKI g ₁p ..., g _tp and random selecting generate private key d and the PKI pk of described first user, wherein, the set of expression integer 1,2 ..., q-2, q-1}; Authentication module, the described part private key k that described authentication module is used for described part private key k and the described private key commit module of described private key generation module generation generate verifies.

According to the authenticated key agreement system based on level identity base without certificate of the embodiment of the present invention, based on the level identity base cryptographic system without certificate, be applicable to large scale system, and method does not contain Bilinear map computing in calculating process, therefore has higher efficiency.The fail safe of method, based on Elliptic Curve Discrete Logarithm difficulty hypothesis and computational Diffie-Hellman difficulty hypothesis, meets the basic security demand needed for key agreement system.

In addition, the authenticated key agreement system based on level identity base without certificate according to the above embodiment of the present invention, can also have following additional technical characteristic:

Further, also comprise: key negotiation module, described key negotiation module is used for any second user A and the 3rd user B, according to the identity vector of described second user A second private key for user is d _a, the second client public key pk _awith the identity vector of described 3rd user B 3rd private key for user d _b, the 3rd client public key pk _b, and the second user and the 3rd user's random selecting with calculate described second user A sends the first session key sk from message use to described 3rd user B _awith described 3rd user B to described second user A send out message use the second session key sk _bif, described first session key sk _awith described second session key sk _bidentical, can securely communicate between described second user A and described 3rd user B.

Additional aspect of the present invention and advantage will part provide in the following description, and part will become obvious from the following description, or be recognized by practice of the present invention.

Accompanying drawing explanation

Above-mentioned and/or additional aspect of the present invention and advantage will become obvious and easy understand from accompanying drawing below combining to the description of embodiment, wherein:

Fig. 1 is the structural representation of the authenticated key agreement system based on level identity base without certificate of one embodiment of the invention;

Fig. 2 is the schematic diagram of the cipher key agreement process of one embodiment of the invention.

Embodiment

Be described below in detail embodiments of the invention, the example of described embodiment is shown in the drawings, and wherein same or similar label represents same or similar element or has element that is identical or similar functions from start to finish.Being exemplary below by the embodiment be described with reference to the drawings, only for explaining the present invention, and can not limitation of the present invention being interpreted as.

In describing the invention, it is to be appreciated that term " first ", " second " only for describing object, and can not be interpreted as instruction or hint relative importance.

With reference to description below and accompanying drawing, these and other aspects of embodiments of the invention will be known.Describe at these and in accompanying drawing, specifically disclose some particular implementation in embodiments of the invention, representing some modes of the principle implementing embodiments of the invention, but should be appreciated that the scope of embodiments of the invention is not limited.On the contrary, embodiments of the invention comprise fall into attached claims spirit and intension within the scope of all changes, amendment and equivalent.

Below in conjunction with accompanying drawing description according to the authentication key agreement method based on level identity base without certificate of the embodiment of the present invention and negotiating system.

Main symbol and elliptic curve are chosen:

1) p, q: Big prime

2) : exponent number is the finite field of p

3) : finite field on elliptic curve E

4) : the set of the point on elliptic curve E is the circled addition group on q rank

5) P: the generator of group G

6) : integer set 1,2 ..., q-2, q-1}

7) PKG: private key generating center

8) H ₁: the hash function of safety,

9) H ₂: the hash function of safety,

10) : session key space

Elliptic curve available equation is expressed as:

Y ²≡ x ³+ ax+bmodp, wherein and 4a ³+ 27b ²≠ 0modp group o is infinity point group for circled addition group, group operatione is add operation (point multiplication operation), is described below:

The present invention can be divided into system to set up, and part private key generates, and private key generates, and private key is entrusted and key agreement double teacher.The method is specifically constructed as follows:

(1) (pp, msk) ← Root-Setup (λ): system is set up algorithm and run by root PKG, chooses the elliptic curve circled addition group that the rank meeting safe constant λ are q namely | q|=λ, generator be P.Choose safe hash function: for session key space.Choose main private key msk=s, calculate PKI P _pub=sP.Export the system parameters of overall importance shared:

(2) (k) ← Partial-Private-KeyGen (msk, ID): part private key generating algorithm is run by root PKG, given main private key msk and any one user identity vector ID=(I ₁, I ₂..., I _t), PKG random selecting calculate r _i=H ₁(I _i|| g _ip), wherein 1≤i≤t.Export the part private key k corresponding to this user:

$k=s+\underset{i=1}{\overset{t}{\Σ}}\left(g_i{r}_i\right)$

If k=0, then need again to choose by safe lane by { g ₁p ..., g _tp, k} send to user (I ₁, I ₂..., I _t), wherein g ₁p ..., g _tp is the part PKI of user ID.User rs authentication equation:

$kP=P_{pub}+\underset{i=1}{\overset{t}{\Σ}}\left(H_1\right(I_i\left|\right|g_{i}P\left)g_{i}P\right)$

If equation is false, then refuse this part private key.

(3) (d) ← Set-Private-Key (k, ID): private key generating algorithm is run by user ID, random selecting export the private key d of this user:

d＝k+x

If d=0, then need again to choose and calculate private key for user.The PKI of this user is pk={ID, g ₁p ..., g _tp, xP}.

(4) (k) ← Partial-Delegate (k ', ID): part private key entrusts algorithm by user ID=(I ₁, I ₂..., I _t) upper strata PKG run, wherein ID _pKG=(I ₁, I ₂..., I _t-1), the part private key of PKG is part PKI is { g ₁p ..., g _t-1p}.Random selecting calculate r _t=H ₁(I _t|| g _tp).PKG is user ID generating portion private key k:

$k=k^{\′}+g_t{r}_t=s+\underset{i=1}{\overset{t-1}{\mathrm{\Σ}}}\left(g_i{r}_i\right)+g_t{r}_t=s+\underset{i=1}{\overset{t}{\mathrm{\Σ}}}\left(g_i{r}_i\right)$

If k=0, then need again to choose by safe lane by { g ₁p ..., g _tp, k} send to user ID, wherein g ₁p ..., g _tp is the part PKI of user.User rs authentication equation:

$kP=P_{pub}+\underset{i=1}{\overset{t}{\Σ}}\left(H_1\right(I_i\left|\right|g_{i}P\left)g_{i}P\right)$

If equation is false, then refuse this part private key.If equation is set up, user can perform private key and the PKI that Set-Private-Key algorithm generates oneself.

(5) (sk) ← Agreement (pk ₁, T ₁, pk ₂, T ₂): cipher key agreement process is as shown in Figure 2.For user A and B, the level wherein residing for user A is l _a, the private key of A is d _a, PKI pk _afor $\{{\mathrm{ID}}_A,g_{1}P,...,g_{l_A}P,x_{A}P\}$ 。Level residing for user B is l _b, ${\mathrm{ID}}_B=\left(I_1^{\′},I_2^{\′},\mathrm{...},I_{l_B}^{\′}\right),$ The private key of B is d _b, PKI pk _bfor

A random selecting calculate T _a=ad _ap, sends { T _a, pk _ato B, B random selecting calculate T _b=bd _bp, sends { T _b, pk _bto A, A and B session key respectively:

User A does following calculating:

$\begin{array}{c}{k}_{AB}=d_A(T_B+a(P_{pub}+x_{B}P+\underset{i=1}{\overset{l_B}{\Σ}}\left(H_1\right({I_i}^{\′}\left|\right|{g_i}^{\′}P\left){g_i}^{\′}P\right)\left)\right)\\ =d_A({\mathrm{bd}}_{B}P+{\mathrm{ad}}_{B}P)=(a+b)d_A{d}_{B}P\\ {\mathrm{ad}}_A{T}_B={\mathrm{abd}}_A{d}_{B}P\end{array}$

Session key is: sk _a=H ₂(k _aB|| abd _ad _bp)

User B does following calculating:

$\begin{array}{c}{k}_{BA}=d_B(T_A+b(P_{pub}+x_{A}P+\underset{i=1}{\overset{l_A}{\Σ}}\left(H_1\right(I_i\left|\right|g_{i}P\left)g_{i}P\right)\left)\right)\\ =d_B({\mathrm{ad}}_{A}P+{\mathrm{bd}}_{A}P)=(a+b)d_A{d}_{B}P=k_{AB}\\ {\mathrm{bd}}_B{T}_A={\mathrm{abd}}_A{d}_{B}P\end{array}$

Session key is: sk _b=H ₂(k _bA|| abd _ad _bp)

User A and B obtains identical session key, can securely communicate.

In addition, other of the authentication key agreement method based on level identity base without certificate of the embodiment of the present invention and negotiating system is formed and effect is all known for a person skilled in the art, in order to reduce redundancy, does not repeat.

In the description of this specification, specific features, structure, material or feature that the description of reference term " embodiment ", " some embodiments ", " example ", " concrete example " or " some examples " etc. means to describe in conjunction with this embodiment or example are contained at least one embodiment of the present invention or example.In this manual, identical embodiment or example are not necessarily referred to the schematic representation of above-mentioned term.And the specific features of description, structure, material or feature can combine in an appropriate manner in any one or more embodiment or example.

Although illustrate and describe embodiments of the invention, those having ordinary skill in the art will appreciate that: can carry out multiple change, amendment, replacement and modification to these embodiments when not departing from principle of the present invention and aim, scope of the present invention is by claim and equivalency thereof.

Claims (9)

1., without the authentication key agreement method based on level identity base of certificate, it is characterized in that, comprise the following steps:

A: according to the safe constant λ of input, show that exponent number is the elliptic curve circled addition group of q its generator is P, chooses main private key msk, calculates PKI P _pub, choose safe hash function H ₁with hash function H ₂;

B: according to the identity vector ID=(I of first user ₁, I ₂..., I _t), the private key d of described first user can be generated by two kinds of algorithms:

B1: according to described main private key msk, described first user identity vector ID=(I ₁, I ₂..., I _t) and random selecting root PKG calculates part private key k and the part PKI g of described first user ₁p ..., g _tp, described first user verifies whether described part private key k meets verification condition, if described part private key k meets verification condition, described first user accepts described part private key k and part PKI g ₁p ..., g _tp;

B2: according to described part private key k and part PKI g ₁p ..., g _tp and first user random selecting generate private key d and the PKI pk of described first user;

Or

B ' 1: according to the identity vector ID=(I of described first user ₁, I ₂..., I _t), the identity vector ID of the upper-layer user of described first user _pKG=(I ₁, I ₂..., I _t-1), the part private key k ' of described upper-layer user, part PKI { g ₁p ..., g _t-1p} and random selecting the PKG of described upper-layer user is described first user generating portion private key k and part PKI g ₁p ..., g _tp, described first user verifies whether described part private key k meets verification condition, if described part private key k meets verification condition, described first user accepts described part private key k and part PKI g ₁p ..., g _tp;

B ' 2: according to described part private key k and part PKI g ₁p ..., g _tp and first user random selecting generate private key d and the PKI pk of described first user.

2. the authentication key agreement method based on level identity base without certificate according to claim 1, it is characterized in that, described steps A comprises further:

Described elliptic curve circled addition group for the elliptic curve circled addition group that the rank meeting safe constant λ are q;

Described PKI P _pub=sP, wherein main private key msk=s;

Described hash function and

Described hash function wherein for session key space.

3. the authentication key agreement method based on level identity base without certificate according to claim 2, it is characterized in that, described step B1 comprises further:

According to described main private key msk, described first user identity vector ID=(I ₁, I ₂..., I _t) and described PKG random selecting calculate r _i=H ₁(I _i|| g _ip), wherein 1≤i≤t, the part private key k of described first user is:

$k=s+\underset{i=1}{\overset{t}{\Σ}}\left(g_i{r}_i\right)$

If k=0, then need again to choose by safe lane by { g ₁p ..., g _tp, k} send to described first user, wherein g ₁p ..., g _tp is the part PKI of described first user, described first user checking following equalities:

$kP=P_{pub}+\underset{i=1}{\overset{t}{\Σ}}\left(H_1\right(I_i\left|\right|g_{i}P\left)g_{i}P\right)$

If equation is false, then refuse described part private key k and part PKI g ₁p ..., g _tp.

4. the authentication key agreement method based on level identity base without certificate according to claim 3, it is characterized in that, described step B2 comprises further:

Random selecting generate described first user private key d,

d＝k+x

If d=0, again choose calculate the private key d of described first user, the PKI of described first user is pk={ID, g ₁p ..., g _tp, xP}.

5. the authentication key agreement method based on level identity base without certificate according to claim 2, is characterized in that, described step B ' 1 comprises further:

According to the identity vector ID=(I of described first user ₁, I ₂..., I _t), the upper-layer user ID of described first user _pKG=(I ₁, I ₂..., I _t-1), the part private key of described upper-layer user part PKI { the g of described upper-layer user ₁p ..., g _t-1p} and random selecting calculate r _t=H ₁(I _t|| g _tp), the PKG of described upper-layer user is that described first user generates described part private key k, and described part private key k is obtained by following formula:

$k=k^{\′}+g_t{r}_t=s+{\mathrm{\Σ}}_{i=1}^{t-1}\left(g_i{r}_i\right)+g_t{r}_t=s+{\mathrm{\Σ}}_{i=1}^t\left(g_i{r}_i\right),$

If k=0, then again choose and calculate described part private key k, by safe lane by { g ₁p ..., g _tp, k} send to described first user, wherein g ₁p ..., g _tp is the part PKI of described first user, described first user checking following equalities:

$kP=P_{pub}+\underset{i=1}{\overset{t}{\Σ}}\left(H_1\right(I_i\left|\right|g_{i}P\left)g_{i}P\right)$

If equation is false, described first user refuses described part private key k and part PKI g ₁p ..., g _tp.

6. the authentication key agreement method based on level identity base without certificate according to claim 5, is characterized in that, described step B ' 2 comprises further:

Random selecting generate described first user private key d,

d＝k+x

If d=0, again choose calculate the private key d of described first user, the PKI of described first user is pk={ID, g ₁p ..., g _tp, xP}.

7., according to the arbitrary described authentication key agreement method based on level identity base without certificate of claim 1-6, it is characterized in that, further comprising the steps of in step B:

C: Stochastic choice second user A and the 3rd user B, according to the identity vector of described second user A second private key for user d _a, the second client public key pk _awith the identity vector of described 3rd user B 3rd private key for user d _b, the 3rd client public key pk _b, and the second user and the 3rd user respectively random selecting with calculate described second user A sends out the first session key sk from message use to described 3rd user B _awith described 3rd user B to described second user A send out message use the second session key sk _bif, described first session key sk _awith described second session key sk _bidentical, can securely communicate between described second user A and described 3rd user B.

8., without the authenticated key agreement system based on level identity base of certificate, it is characterized in that, comprising:

System sets up module, for the safe constant λ according to input, show that exponent number is q elliptic curve circled addition group its generator is P, chooses main private key msk, calculates PKI P _pub, choose safe hash function H ₁with hash function H ₂;

Private key generation module, described private key generation module is used for according to described main private key msk, described first user identity vector ID=(I ₁, I ₂..., I _t) and random selecting calculate part private key k and the part PKI g of described first user ₁p ..., g _tp, after verifying by authentication module, and according to described part private key k and part PKI g ₁p ..., g _tp and random selecting generate private key d and the PKI pk of described first user, wherein, the set of expression integer 1,2 ..., q-2, q-1};

Private key commit module, described private key commit module is used for the identity vector ID=(I according to described first user ₁, I ₂..., I _t), the upper-layer user ID of described first user _pKG=(I ₁, I ₂..., I _t-1), the part private key k ' of described upper-layer user, part PKI { g ₁p ..., g _t-1p} and random selecting generate part private key k and the part PKI g of described first user ₁p ..., g _tp, after described authentication module checking, and according to described part private key k and part PKI g ₁p ..., g _tp and random selecting generate private key d and the PKI pk of described first user, wherein, the set of expression integer 1,2 ..., q-2, q-1};

Authentication module, the described part private key k that described authentication module is used for described part private key k and the described private key commit module of described private key generation module generation generate verifies.

9. the authenticated key agreement system based on level identity base without certificate according to claim 8, is characterized in that, also comprise:

Key negotiation module, described key negotiation module is used for any second user A and the 3rd user B, according to the identity vector of described second user A second private key for user d _a, the second client public key pk _awith the identity vector of described 3rd user B 3rd private key for user d _b, the 3rd client public key pk _b, and the second user and the 3rd user respectively random selecting with calculate described second user A sends the first session key sk from message use to described 3rd user B _awith described 3rd user B to described second user A send out message use the second session key sk _bif, described first session key sK _awith described second session key sk _bidentical, can securely communicate between described second user A and described 3rd user B.